Reflected Cross-Site Scripting Vulnerability in WP Customer Area Plugin for WordPress
CVE-2024-0665

6.1MEDIUM

Key Information:

Vendor
Wordpress
Status
WP Customer Area
Vendor
CVE Published:
24 January 2024

Summary

The WP Customer Area plugin for WordPress suffers from a reflected cross-site scripting vulnerability due to inadequate input sanitization and output escaping related to the 'tab' parameter. This flaw allows unauthenticated attackers to execute arbitrary web scripts on user pages, potentially compromising user data and session integrity when users are tricked into clicking malicious links. All versions up to and including 8.2.1 are affected.

Affected Version(s)

WP Customer Area * <= 8.2.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3025865/cust...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.